@k2b/cloud 0.6.0-rc.0

package/src/services/ipa/guard.ts

@@ -0,0 +1,17 @@
+import type { MutationResult } from "../../contracts/shared";
+import { getFreeIpaConfig } from "../freeipa-config";
+
+type MutationError = Extract<MutationResult<unknown>, { ok: false }>;
+
+export const getIpaUrl = async (): Promise<string> => (await getFreeIpaConfig()).url;
+
+export const ensureFreeIpaMutationAvailable = async (): Promise<MutationError | null> => {
+  const config = await getFreeIpaConfig();
+  if (!config.enabled) {
+    return { ok: false, error: "FreeIPA is disabled.", status: 400 };
+  }
+  if (!config.configured) {
+    return { ok: false, error: `FreeIPA is enabled but not fully configured. Missing: ${config.missingSettings.join(", ")}.`, status: 500 };
+  }
+  return null;
+};

package/src/services/ipa/index.ts

@@ -0,0 +1,17 @@
+import { providers } from "../providers";
+import { search } from "./search";
+
+export const ipa = {
+  auth: providers.ipa.auth,
+  users: {
+    ...providers.ipa.users,
+    addIpa: providers.ipa.users.create,
+    delete: providers.ipa.users.remove,
+  },
+  groups: {
+    ...providers.ipa.groups,
+    delete: providers.ipa.groups.remove,
+  },
+  search,
+  sync: providers.ipa.sync,
+};

package/src/services/ipa/posix.ts

@@ -0,0 +1,19 @@
+import { sql } from "bun";
+
+/** Mirror directory-owned attributes, including missing values; never apply local defaults. */
+export const mirrorIpaPosix = async (
+  db: typeof sql,
+  user: {
+    userId: string;
+    uidNumber: number | null;
+    primaryGidNumber: number | null;
+    homeDirectory: string | null;
+    loginShell: string | null;
+  },
+): Promise<void> => {
+  await db`INSERT INTO auth.user_posix(user_id, managed_by, uid_number, primary_gid_number, home_directory, login_shell)
+    VALUES (${user.userId}::uuid, 'ipa', ${user.uidNumber}, ${user.primaryGidNumber}, ${user.homeDirectory}, ${user.loginShell})
+    ON CONFLICT(user_id) DO UPDATE SET uid_number = EXCLUDED.uid_number,
+      primary_gid_number = EXCLUDED.primary_gid_number, home_directory = EXCLUDED.home_directory, login_shell = EXCLUDED.login_shell
+    WHERE auth.user_posix.managed_by = 'ipa'`;
+};

package/src/services/ipa/profile.ts

@@ -0,0 +1,132 @@
+/**
+ * Centralized profile calculation for IPA-backed users.
+ *
+ * Full sync writes `auth.ipa_user_effective_groups` from FreeIPA group_find.
+ * Local group mutations keep that projection as source of truth; the local
+ * display mirror is only a bootstrap fallback before the first full sync.
+ */
+
+import { sql } from "bun";
+import { calculateIpaProfileFromGroupNames } from "../account-model";
+import { getFreeIpaConfig } from "../freeipa-config";
+
+type DbRow = Record<string, unknown>;
+
+/**
+ * Get all IPA group names a user belongs to (direct + inherited via parent groups).
+ */
+export const getAllUserGroups = async (userId: string): Promise<string[]> => {
+  const rows: DbRow[] = await sql`
+    WITH RECURSIVE all_groups AS (
+      SELECT ug.group_id
+      FROM auth.user_groups_v2 ug
+      JOIN auth.groups g ON g.id = ug.group_id
+      WHERE ug.user_id = ${userId} AND g.provider = 'ipa'
+      UNION
+      SELECT gg.parent_group_id
+      FROM auth.group_groups_v2 gg
+      JOIN auth.groups g ON g.id = gg.parent_group_id
+      JOIN all_groups ag ON gg.child_group_id = ag.group_id
+      WHERE g.provider = 'ipa'
+    )
+    SELECT DISTINCT g.name
+    FROM all_groups ag
+    JOIN auth.groups g ON g.id = ag.group_id
+    ORDER BY g.name
+  `;
+
+  return rows.map((row) => row.name as string);
+};
+
+export const getEffectiveUserGroups = async (userId: string): Promise<string[]> => {
+  const rows: DbRow[] = await sql`
+    SELECT group_name
+    FROM auth.ipa_user_effective_groups
+    WHERE user_id = ${userId}::uuid
+    ORDER BY group_name
+  `;
+
+  return rows.map((row) => row.group_name as string);
+};
+
+/**
+ * Calculate canonical IPA profile from effective group names. Reads
+ * `freeipa.groups.base_ipa_realm` from settings (cache-aside).
+ */
+export const calculateIpaProfile = async (memberOfGroups: string[]): Promise<"user" | "guest"> => {
+  const config = await getFreeIpaConfig();
+  return calculateIpaProfileFromGroupNames(memberOfGroups, config.groupsBaseIpaRealm);
+};
+
+/**
+ * Calculate canonical IPA profile for a user from the local DB mirror.
+ */
+export const calculateIpaProfileFromLocalDb = async (userId: string): Promise<"user" | "guest"> => {
+  const groups = await getAllUserGroups(userId);
+  return calculateIpaProfile(groups);
+};
+
+export const calculateIpaProfileFromEffectiveProjection = async (userId: string): Promise<"user" | "guest"> => {
+  const groups = await getEffectiveUserGroups(userId);
+  return calculateIpaProfile(groups);
+};
+
+const rebuildEffectiveProjectionFromLocalMirror = async (userId: string): Promise<string[]> => {
+  const groups = await getAllUserGroups(userId);
+  await sql`
+    DELETE FROM auth.ipa_user_effective_groups
+    WHERE user_id = ${userId}::uuid
+  `;
+
+  for (const group of groups) {
+    await sql`
+      INSERT INTO auth.ipa_user_effective_groups (user_id, group_name)
+      VALUES (${userId}::uuid, ${group})
+      ON CONFLICT DO NOTHING
+    `;
+  }
+
+  return groups;
+};
+
+const getEffectiveUserGroupsWithMirrorFallback = async (userId: string): Promise<string[]> => {
+  const projectedGroups = await getEffectiveUserGroups(userId);
+  if (projectedGroups.length > 0) return projectedGroups;
+  return rebuildEffectiveProjectionFromLocalMirror(userId);
+};
+
+/**
+ * Update one IPA-backed user's canonical profile projection.
+ */
+export const updateUserIpaProfile = async (userId: string): Promise<void> => {
+  const groups = await getEffectiveUserGroupsWithMirrorFallback(userId);
+  const profile = await calculateIpaProfile(groups);
+  await sql`
+    UPDATE auth.users
+    SET provider = 'ipa',
+        profile = ${profile}
+    WHERE id = ${userId} AND provider = 'ipa'
+  `;
+};
+
+/**
+ * Update all IPA-backed users affected by a group hierarchy change.
+ */
+export const updateProfileForAffectedUsers = async (groupId: string): Promise<void> => {
+  const affectedUsers: DbRow[] = await sql`
+    WITH RECURSIVE affected_groups AS (
+      SELECT ${groupId}::uuid AS group_id
+      UNION
+      SELECT gg.child_group_id
+      FROM auth.group_groups_v2 gg
+      JOIN affected_groups ag ON gg.parent_group_id = ag.group_id
+    )
+    SELECT DISTINCT ug.user_id
+    FROM auth.user_groups_v2 ug
+    JOIN affected_groups ag ON ug.group_id = ag.group_id
+  `;
+
+  for (const row of affectedUsers) {
+    await updateUserIpaProfile(row.user_id as string);
+  }
+};

package/src/services/ipa/runtime.ts

@@ -0,0 +1,28 @@
+export type IpaSyncRuntime = {
+  signal?: AbortSignal;
+  heartbeat?: () => Promise<void>;
+};
+
+export const createIpaRuntimeCheckpoint = (
+  runtime: IpaSyncRuntime,
+  options: {
+    intervalMs?: number;
+    now?: () => number;
+    onHeartbeat?: () => void;
+  } = {},
+): ((force?: boolean) => Promise<void>) => {
+  const intervalMs = options.intervalMs ?? 30_000;
+  const now = options.now ?? Date.now;
+  let lastHeartbeatAt: number | null = null;
+
+  return async (force = false) => {
+    if (runtime.signal?.aborted) throw new DOMException("FreeIPA operation was cancelled", "AbortError");
+    const currentTime = now();
+    if (runtime.heartbeat && (force || lastHeartbeatAt === null || currentTime - lastHeartbeatAt >= intervalMs)) {
+      await runtime.heartbeat();
+      lastHeartbeatAt = now();
+      options.onHeartbeat?.();
+    }
+    if (runtime.signal?.aborted) throw new DOMException("FreeIPA operation was cancelled", "AbortError");
+  };
+};

package/src/services/ipa/search.ts

@@ -0,0 +1,154 @@
+import { sql } from "bun";
+import type { BaseGroup, BaseUser, UserProfile, UserProvider } from "../../contracts/shared";
+import { freeipa } from "../../server/services";
+import { buildRoles } from "../account-model";
+import { getFreeIpaConfig } from "../freeipa-config";
+import { toPgTextArray, toPgUuidArray } from "../postgres";
+
+// ==========================
+// Search Options
+// ==========================
+
+export type SearchOptions = {
+  /** Search users */
+  users?: boolean;
+  /** Search groups */
+  groups?: boolean;
+  /** User UUIDs to exclude from results */
+  excludeUserIds?: string[];
+  /** Group IDs to exclude from results */
+  excludeGroups?: string[];
+  /** Only return groups the user is a member of */
+  onlyUserGroups?: string[];
+  /** Only return POSIX groups (have gid_number) */
+  onlyPosixGroups?: boolean;
+  /** Only return users that are members of these groups */
+  usersInGroups?: string[];
+};
+
+// ==========================
+// Search (autocomplete for member/manager add dialogs)
+// Returns BaseUser/BaseGroup (no relations needed for autocomplete)
+// ==========================
+
+/**
+ * Executes a filtered lookup query and returns normalized matches.
+ */
+export const search = async (query: string, options: SearchOptions): Promise<{ users: BaseUser[]; groups: BaseGroup[] }> => {
+  const q = `%${freeipa.util.escapeLike(query.toLowerCase())}%`;
+  let users: BaseUser[] = [];
+  let groups: BaseGroup[] = [];
+
+  // ========== Search Users ==========
+  if (options.users) {
+    const excludeIds = options.excludeUserIds ?? [];
+    const inGroups = options.usersInGroups ?? [];
+    const groupsAdmin = (await getFreeIpaConfig()).groupsAdmin;
+
+    // Build optional WHERE fragments
+    const excludeFilter = excludeIds.length > 0 ? sql`AND u.id <> ALL(${toPgUuidArray(excludeIds)}::uuid[])` : sql``;
+    const groupFilter =
+      inGroups.length > 0
+        ? sql`AND EXISTS (
+            SELECT 1
+            FROM auth.user_groups_v2 ug
+            JOIN auth.groups g ON g.id = ug.group_id
+            WHERE ug.user_id = u.id
+              AND g.provider = 'ipa'
+              AND ug.group_id = ANY(${toPgUuidArray(inGroups)}::uuid[])
+          )`
+        : sql``;
+
+    const rows = await sql`
+      SELECT u.id, u.uid, u.provider, u.profile, u.given_name, u.sn, u.display_name, u.mail, u.avatar_hash,
+        EXISTS(
+          SELECT 1
+          FROM auth.ipa_user_effective_groups eg
+          WHERE eg.user_id = u.id
+            AND eg.group_name = ANY(${toPgTextArray(groupsAdmin)}::text[])
+        ) AS effective_admin
+      FROM auth.users u
+      WHERE u.provider = 'ipa'
+        AND (
+          LOWER(u.uid) LIKE ${q} ESCAPE '\\' OR LOWER(u.display_name) LIKE ${q} ESCAPE '\\' OR
+          LOWER(u.given_name) LIKE ${q} ESCAPE '\\' OR LOWER(u.sn) LIKE ${q} ESCAPE '\\' OR LOWER(u.mail) LIKE ${q} ESCAPE '\\'
+        )
+        ${excludeFilter}
+        ${groupFilter}
+      ORDER BY u.uid
+      LIMIT 10
+    `;
+
+    type UserRow = {
+      id: string;
+      uid: string;
+      provider: UserProvider;
+      profile: UserProfile;
+      effective_admin: boolean | null;
+      given_name: string | null;
+      sn: string | null;
+      display_name: string | null;
+      mail: string | null;
+      avatar_hash: string | null;
+    };
+    users = (rows as UserRow[]).map((row) => ({
+      id: row.id,
+      uid: row.uid,
+      roles: buildRoles({
+        provider: row.provider,
+        profile: row.profile,
+        memberofGroup: [],
+        manages: [],
+        admin: Boolean(row.effective_admin),
+      }),
+      provider: row.provider,
+      profile: row.profile,
+      givenname: row.given_name ?? "",
+      sn: row.sn ?? "",
+      displayName: row.display_name ?? "",
+      mail: row.mail ?? null,
+      avatarHash: row.avatar_hash,
+    }));
+  }
+
+  // ========== Search Groups ==========
+  if (options.groups) {
+    const excludeIds = options.excludeGroups ?? [];
+    const onlyUserGroups = options.onlyUserGroups ?? [];
+    const onlyPosix = options.onlyPosixGroups ?? false;
+
+    // Build optional WHERE fragments
+    const excludeFilter = excludeIds.length > 0 ? sql`AND id <> ALL(${toPgUuidArray(excludeIds)}::uuid[])` : sql``;
+    const userGroupsFilter = onlyUserGroups.length > 0 ? sql`AND id = ANY(${toPgUuidArray(onlyUserGroups)}::uuid[])` : sql``;
+    const posixFilter = onlyPosix ? sql`AND gid_number IS NOT NULL` : sql``;
+
+    const rows = await sql`
+      SELECT id, provider, name, description, gid_number
+      FROM auth.groups
+      WHERE provider = 'ipa'
+        AND (LOWER(name) LIKE ${q} ESCAPE '\\' OR LOWER(description) LIKE ${q} ESCAPE '\\')
+        ${excludeFilter}
+        ${userGroupsFilter}
+        ${posixFilter}
+      ORDER BY name
+      LIMIT 10
+    `;
+
+    type GroupRow = {
+      id: string;
+      provider: UserProvider;
+      name: string;
+      description: string | null;
+      gid_number: number | null;
+    };
+    groups = (rows as GroupRow[]).map((row) => ({
+      id: row.id,
+      provider: row.provider,
+      name: row.name,
+      description: row.description ?? null,
+      gidnumber: row.gid_number ?? null,
+    }));
+  }
+
+  return { users, groups };
+};

package/src/services/ipa/service-account.ts

@@ -0,0 +1,15 @@
+import type { MutationResult } from "../../contracts/shared";
+import { getFreeIpaConfig } from "../freeipa-config";
+import { providers } from "../providers";
+
+export const getServiceIpaSession = async (): Promise<MutationResult<string>> => {
+  if (!(await getFreeIpaConfig()).enabled) {
+    return { ok: false, error: "FreeIPA is disabled.", status: 400 };
+  }
+
+  try {
+    return { ok: true, data: await providers.ipa.auth.getServiceSession() };
+  } catch {
+    return { ok: false, error: "Internal FreeIPA service session unavailable.", status: 500 };
+  }
+};

package/src/services/ipa/sync-planning.ts

@@ -0,0 +1,100 @@
+export type IpaIdentity = {
+  uid: string;
+  mail: string | null;
+};
+
+export const readCompleteIpaList = (params: {
+  response: {
+    result: { result?: unknown; truncated?: unknown } | null;
+    error: { message: string } | null;
+  };
+  entity: string;
+}): Record<string, unknown>[] => {
+  if (params.response.error) {
+    throw new Error(`IPA ${params.entity} fetch failed: ${params.response.error.message}`);
+  }
+  const records = params.response.result?.result;
+  if (!Array.isArray(records)) {
+    throw new Error(`IPA ${params.entity} fetch returned invalid list payload`);
+  }
+  if (params.response.result?.truncated === true) {
+    throw new Error(`IPA ${params.entity} fetch returned a truncated snapshot`);
+  }
+  if (params.response.result?.truncated !== false) {
+    throw new Error(`IPA ${params.entity} fetch returned invalid completeness metadata`);
+  }
+  return records as Record<string, unknown>[];
+};
+
+export type IpaDestructionGuardLimits = {
+  maxUserChanges: number;
+  maxUserChangePercent: number;
+  maxGroupDeletions: number;
+  maxGroupDeletionPercent: number;
+};
+
+export type IpaDestructionGuardReport = {
+  userChanges: number;
+  userChangePercent: number;
+  localUsers: number;
+  groupDeletions: number;
+  groupDeletionPercent: number;
+  localGroups: number;
+  limits: IpaDestructionGuardLimits;
+  violations: Array<"user_count" | "user_percent" | "group_count" | "group_percent">;
+};
+
+export const selectStaleLocalIpaRows = <T extends IpaIdentity>(params: { localRows: T[]; activeRemoteUsers: IpaIdentity[] }): T[] => {
+  const activeUids = new Set(params.activeRemoteUsers.map((user) => user.uid));
+  const activeMails = new Set(params.activeRemoteUsers.map((user) => user.mail).filter((mail): mail is string => Boolean(mail)));
+
+  return params.localRows.filter((row) => {
+    if (activeUids.has(row.uid)) return false;
+    if (row.mail && activeMails.has(row.mail)) return false;
+    return true;
+  });
+};
+
+const percentage = (affected: number, total: number): number => {
+  if (affected === 0) return 0;
+  if (total <= 0) return 100;
+  return (affected / total) * 100;
+};
+
+export const assessIpaDestructionGuard = (params: {
+  affectedUserIds: Iterable<string>;
+  localUsers: number;
+  deletedGroupNames: Iterable<string>;
+  localGroups: number;
+  limits: IpaDestructionGuardLimits;
+}): IpaDestructionGuardReport => {
+  const userChanges = new Set(params.affectedUserIds).size;
+  const groupDeletions = new Set(params.deletedGroupNames).size;
+  const userChangePercent = percentage(userChanges, params.localUsers);
+  const groupDeletionPercent = percentage(groupDeletions, params.localGroups);
+  const violations: IpaDestructionGuardReport["violations"] = [];
+
+  if (userChanges > params.limits.maxUserChanges) violations.push("user_count");
+  if (userChangePercent > params.limits.maxUserChangePercent) violations.push("user_percent");
+  if (groupDeletions > params.limits.maxGroupDeletions) violations.push("group_count");
+  if (groupDeletionPercent > params.limits.maxGroupDeletionPercent) violations.push("group_percent");
+
+  return {
+    userChanges,
+    userChangePercent,
+    localUsers: params.localUsers,
+    groupDeletions,
+    groupDeletionPercent,
+    localGroups: params.localGroups,
+    limits: params.limits,
+    violations,
+  };
+};
+
+export const formatIpaDestructionGuardFailure = (report: IpaDestructionGuardReport): string =>
+  `Refusing IPA sync: destructive plan exceeds configured guard limits ` +
+  `(users ${report.userChanges}/${report.localUsers} = ${report.userChangePercent.toFixed(2)}%, ` +
+  `limits ${report.limits.maxUserChanges} and ${report.limits.maxUserChangePercent}%; ` +
+  `groups ${report.groupDeletions}/${report.localGroups} = ${report.groupDeletionPercent.toFixed(2)}%, ` +
+  `limits ${report.limits.maxGroupDeletions} and ${report.limits.maxGroupDeletionPercent}%; ` +
+  `violations: ${report.violations.join(", ")})`;